> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# Privacy and Security

> The BigCommerce certifications behind Catalyst, its default Content Security Policy, consent management, and Next.js framework security.

Catalyst's privacy and security come from three places: the certifications of the BigCommerce platform it runs on, the security practices built into Catalyst itself, and the Next.js framework. This page covers each.

## BigCommerce certifications

By default, all commerce operations and checkout use BigCommerce's GraphQL APIs and hosted checkout, which are covered by the following data privacy and security certifications:

* **CCPA**
* **CSA STAR**
* **EU-US DPF**
* **FIPS 140-2**
* **GDPR**
* **ISO 22301**
* **ISO 27001 SoA**
* **ISO 27001:2022**
* **ISO 27017**
* **ISO 27018**
* **ISO 27701**
* **PCI DSS**
* **Privacy Shield**
* **RH-ISAC**
* **SOC 1, SOC 2, SOC 3**
* **TX-RAMP**
* **Visa Service Provider**

You can learn more about these certifications and request a security review at [security.bigcommerce.com](https://security.bigcommerce.com).

### Security vulnerability monitoring

Catalyst is part of BigCommerce's bug bounty program. The BigCommerce security team monitors and responds to reports, and also scans and reviews the codebase internally. For details, see [SECURITY.md](https://github.com/bigcommerce/catalyst/blob/canary/SECURITY.md) in the Catalyst repository.

## Best practices implemented

### Limited data access

By default, Catalyst uses only the GraphQL Storefront API, which has no access to admin functionality. It's scoped to the storefront and to anonymous or signed-in shoppers.

### Content Security Policy (CSP)

Catalyst sends a Content Security Policy (CSP) header on every response, which you can extend to meet your organization's specific security standards. A CSP lets you specify the sources of content that are allowed to load on your site, which helps to prevent Cross-Site Scripting (XSS) and data injection attacks.

The default policy is deliberately minimal. It sets only two directives:

* `base-uri 'self'`
* `frame-ancestors`, set to `'none'` so other sites can't embed your storefront in a frame. When `MAKESWIFT_SITE_API_KEY` is set, it allows the Makeswift editor origin instead (`MAKESWIFT_BASE_URL`, defaulting to `https://app.makeswift.com`), so the visual editor can load your storefront.

Every other directive (`default-src`, `script-src`, `img-src`, and so on) is included but commented out, ready for you to enable. Customize the policy in [`lib/content-security-policy.ts`](https://github.com/bigcommerce/catalyst/blob/canary/core/lib/content-security-policy.ts). The header itself is applied in the `headers()` function in `next.config.ts`.

## Consent management

Catalyst includes a built-in cookie consent manager powered by [c15t](https://c15t.com). It displays a consent banner to shoppers, respects their preferences by controlling which scripts load, and stores consent decisions locally in the shopper's browser. Cookie consent support is available in Catalyst v1.3.0 and later.

![Catalyst cookie consent banner](/_fern-img/1885fa3020d858e3324479af0ee5219e4b42c619114dd650e2310c5a987b13b7.webp)

For full details on default cookies, consent categories, configuration options, and connecting to a backend consent service, see the [Cookie Consent](/developer/docs/storefront/catalyst/features/cookie-consent) guide.

## Framework benefits

### Next.js security record

Next.js has hundreds of active contributors and a consistently high [package health score](https://snyk.io/advisor/npm-package/next) from Snyk.

### Industry adoption

Next.js is used by companies that handle millions of users and sensitive data in sectors including commerce, ticketing, and media. For examples, see the [Next.js showcase](https://nextjs.org/showcase).